內容簡介
ZAIA Security 是一款安全外掛，透過連接 ZAIA 請求驗證服務，確保網站的敏感操作來自合法的請求，增強網站的安全性，防止機器人和惡意攻擊。
【主要功能】
• 驗證登錄、註冊及密碼重置請求
• 檢查評論及 REST API 寫入
• 支援無密碼登入選項
• 自動隔離可疑 IP 地址
• 安裝時觀察模式，無阻擋操作
• 兼容其他安全外掛
外掛標籤
開發者團隊
原文外掛簡介
ZAIA Security connects your site to ZAIA, a request-context verification service run by NEWTIV. It does not replace WordPress accounts: for every sensitive action, it checks that the request really comes from your site, from the same device, and that the behaviour stays plausible.
Actions checked (your choice):
login (wp-login.php and WooCommerce), registration, lost password;
comments;
REST API writes from the browser (block editor, admin);
WooCommerce checkout.
Passwordless sign-in for visitors (optional): « Continue with Google » or a code received by email, through the ZAIA sign-in page. In Settings → ZAIA you choose the page where it appears, the format (inside the page, in a window, or full page) and its appearance (colour, corner radius, light or dark mode), with a preview, no code needed. Accounts stay in WordPress: an existing account is found by its verified email address, and, if you enable it and your site allows registration, a new account is created with the Subscriber role (Customer with WooCommerce) once ZAIA has verified the email address. Sign-in goes through wp_signon(), so other security plugins still apply. Visitor accounts never see the WordPress dashboard.
What ZAIA detects: bots and scripts, credential stuffing, replay of captured requests, stolen sessions reused elsewhere, bursts of requests, impossible country changes. Addresses that pile up alerts are quarantined automatically.
Safe for your site:
observation mode on install: everything is checked and logged in the ZAIA console, nothing is blocked;
if ZAIA does not respond, the site keeps working (configurable);
application passwords, WP-CLI, cron and server integrations are never affected.
The plugin is ready for translation through translate.wordpress.org.
External services
This plugin relies on the ZAIA service (https://zaia.newtiv.com), operated by NEWTIV (Abidjan, Côte d’Ivoire). Nothing is sent until an administrator enters a ZAIA application identifier and server key in Settings → ZAIA.
What is sent, and when:
From the visitor’s browser (only on the forms you choose to protect, and on the sign-in page you enable): the ZAIA client script, bundled with the plugin, opens a session with https://zaia.newtiv.com/v1/handshake/ and adds ZAIA headers to the form. ZAIA receives the browser’s IP address, user agent, page origin and, if available, screen size, time zone and language.
From your server, when a protected form is submitted: a verification request to https://zaia.newtiv.com/v1/verify with the session headers, the visitor’s IP address and user agent. For a signed-in user, a technical identifier wp:
Passwordless sign-in (only if enabled): the visitor uses the ZAIA sign-in page (https://zaia.newtiv.com/login/), shown in your page, in a window or full page. After sign-in, your server exchanges a one-time code at https://zaia.newtiv.com/v1/connect/token and receives the visitor’s identifier, email address and name.
Configuration test (the « Test » button in Settings → ZAIA): https://zaia.newtiv.com/v1/app returns the application’s settings.
The service: Terms of use · Privacy policy · Service status.
ZAIA offers a free plan (100,000 requests per month per application) and a custom Enterprise plan on quote. Every feature of this plugin works with the free plan.
